Privacy Policy

mHub is operated by CSGME (ABN 76 453 500 515), trading as mHub. This policy covers the mhub.au website and everything we do with the information it collects. Anything you want to ask or object to goes to hello@mhub.au, and a person reads it.

Only what an account and an order need.

• Your account. Email address, name, and either a passkey or a password. We store passwords only as a bcrypt hash, so we cannot read yours. If you use two-factor authentication we store the secret that makes it work.
• Your orders. Delivery name, phone number and address, what you ordered, what it cost, and where it is up to.
• Your files. The drawings you upload, and any documents attached to an order such as test certificates and delivery dockets.
• Anything you send us. Problems you report through the site, including whatever you type and any file you attach, plus feedback you give on a completed order.
• The waitlist. If you ask for an invite, we keep your email address until you have an account or ask us to remove it.
• Fabricators. If you use mHub as a supplier, we hold your business contact details, address, ABN and the rates you give us.
• A record of admin actions. When someone at mHub changes an order or an account, we log what changed and who changed it, so a dispute can be answered with a record rather than a recollection.

We do not collect payment card details at all. Those go straight to Stripe and never touch our systems. All we keep is a reference to the Stripe session.

To quote your parts, take payment for them, get them made and delivered, keep your order history where you can see it, answer you when you contact us, and keep the transaction records the tax law requires. That is the list. We do not collect anything for a purpose we have not told you about here.

Your drawings stay yours. We store and process them to quote them to you, and we send a drawing to a fabricator only when you have ordered that part.

We never use your files to train any model or machine learning system, and we never share them with anyone outside the purpose of making your order. The full licence you give us is in section 4 of our Terms of Service.

Three parties, and no others.

The fabricator who makes your order. This is the one routine disclosure we make, and payment is what triggers it. Before you pay, you see the shop as a suburb and a distance, and the shop gets nothing at all: no drawing, no name, no address. When you pay, the two of you are introduced, and the fabricator receives your delivery name, phone number, address and the drawing, because they cannot make and deliver the part without them. They receive nothing beyond that, and no fabricator ever sees the file for a job you did not order.

Stripe processes the payment. You enter your card details on Stripe's own checkout page, not ours, and Stripe handles them under its own terms and privacy policy.

Fastmail carries our email, so anything we send you about an order passes through their servers, as email does.

Beyond those three, we disclose personal information only where the law requires or allows it, such as reporting suspected unlawful activity to the authorities (see What you cannot order in our terms). We do not sell it, rent it, or trade it, ever.

Worth stating plainly, because most sites you use do all of this and we do none of it.

• No analytics and no tracking. There is no Google Analytics, no Tag Manager, no Plausible, no PostHog, no Sentry, no Mixpanel, no Hotjar and no equivalent anywhere on this site. The one thing we note is how you found us, explained under Cookies below.
• No advertising and no advertising pixels. Nothing here follows you to another site.
• No profiling and no automated decisions about you. Our quoting engine prices geometry, not people.
• No data sales, no data sharing for marketing.
• No marketing email. We email you about your orders and your account, and when you contact us. That is all.

We set three cookies, all our own, all strictly necessary, and none of them used to track you: one that keeps you signed in, one that renews that session, and, for fabricators who work with more than one shop, one that remembers which shop the portal is acting as. All three are read only by our server and never by anything running in the page.

There are no third-party cookies on this site, which is why you have not been asked to dismiss a cookie banner.

Your cart lives in your own browser's storage, not on our server. Nothing in it reaches us until you place the order.

Your browser also notes how you found us: the campaign tag on the link you arrived by (the utm_ part of a link from one of our posts, if it had one) and the name of the site that linked here, such as linkedin.com. Not the page on that site, not an advertising click id, and nothing that follows you anywhere else. Your browser forgets it if you stay away for a while, and it reaches us only with an order, where it tells us which of our posts are worth making.

mHub runs on a single server we operate in Australia, and your files and order records live on it. Stripe and Fastmail hold their own part overseas, as described above. Backups are encrypted on our server before they leave it and stored with a backup provider in the United States, who holds only encrypted data and cannot read it.

The protections in place today:

• Passkeys, so an account can be held without a password at all.
• Passwords stored only as bcrypt hashes, never in a form we can read.
• Two-factor authentication required on mHub administrator accounts.
• Registration by invitation only.
• Account recovery tokens hashed at rest, so a stolen backup yields none.
• HTTPS on everything.
• Encrypted backups, taken nightly and verified.

No system is beyond reach, and we are not going to pretend otherwise. If something happens that affects your information, we will tell you what happened and what we are doing about it.

We keep your files while we quote your parts and make them, and for as long afterwards as a problem with the order could still come back to us. If a part turns out to be wrong, the drawing you sent is how we work out what happened, so throwing it away early would leave both of us guessing.

You can ask us to delete your files at any time, at hello@mhub.au, and we will. Two exceptions, which we would rather state than spring on you: we keep what we need for a problem or a claim that is already running or that we reasonably expect, and we keep the minimum record of what was supplied and what was paid for it, which the tax law requires us to hold for five years. Neither is used for anything else.

If you close your account we remove your profile and your files, subject to those same two exceptions.

Email hello@mhub.au and we will tell you what we hold about you, fix anything that is wrong, or delete it, subject to the transaction record above. There is no form and no process to navigate, and we do not charge for it.

If you are not happy with how we have handled your information, say so at the same address and we will deal with it directly.

If what we do changes, this page changes with it, and the revision date at the top moves. We will not quietly start doing something this page says we do not do.